What is GHSA-hjxc-462x-x77j?

GHSA-hjxc-462x-x77j is a security advisory published by GitHub Security Advisories with Medium severity. TOCTOU Race Condition in Yarn

Which CVE IDs does GHSA-hjxc-462x-x77j cover?

GHSA-hjxc-462x-x77j covers the following CVE IDs: CVE-2019-15608. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hjxc-462x-x77j?

GHSA-hjxc-462x-x77j has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-hjxc-462x-x77j?

GHSA-hjxc-462x-x77j affects 1 product, including: npm/yarn:\u003c 1.19.0.

GHSA-hjxc-462x-x77jMediumCVSS 5.9

TOCTOU Race Condition in Yarn

Vendor

GitHub Security Advisories

Published

February 9, 2022

Last Modified

September 8, 2023

🔗 CVE IDs covered (1)

CVE-2019-15608 →

📋 Description

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.

🎯 Affected products1

npm/yarn:< 1.19.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-15608
https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c
https://hackerone.com/reports/703138
https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190
https://github.com/advisories/GHSA-hjxc-462x-x77j